Two pgEdge libraries disclosed fragments of configured LLM provider API keys in unauthenticated error messages. pgEdge Go LLM Library (versions 0.1.0-0.1.1) and pgEdge RAG Server (version 1.0.0 and earlier) exposed partial credentials when providers rejected authentication attempts.
Disclosed 12 November 2026 · Record updated 13 November 2026
Unauthenticated remote attackers could read fragments of LLM provider API keys from error messages, potentially enabling account compromise of third-party LLM provider accounts.
VulnerabilitiesTwo advisories published on 12 November 2026 say unauthenticated callers could read parts of an operator's provider credential returned verbatim in error responses.
13 Nov 2026
